Qwen2.5 Program Slicing Security Auditor

JavaScript security audit for web devs

WHO USES ITWeb developer · Security beginner · Bug-bounty hunter

Use in the browser

Paste JS or HTML; a fine-tuned 7B model traces each risky sink to an exploit and verdict.

♥ 1As of 09-16 21:00 UTC

1 Hugging Face likes observed 09-13 09:30 UTC Hugging Face check 88 h late

NEW 1h OLD WHEN SEEN

The auditor's dark UI: a four-step pipeline diagram at the top, a code editor with the 'Run 4-Step Security Audit' button on the left, and the findings panel on the right.

TESIGN TAKE

Narrowing the scope with parsing before the model speaks keeps each finding small enough to check yourself.

AT A GLANCE

WHY IT MATTERS

Feeding a whole minified bundle to a model is expensive and scatters the context. This Space first beautifies the code, walks the syntax tree for dangerous sinks such as innerHTML, eval, sendFile and fetch, cuts a roughly 50-line slice around each, and hands the slices one by one to a Qwen2.5-Coder 7B model fine-tuned for security reasoning, which writes a dataflow trace → proof-of-concept → verdict. Snippets of 70 lines or fewer are audited whole, and you can upload .js, .html, .ts, .php or .json files instead of pasting.

BUILD FROM THIS

A second opinion on a frontend bundle or an Express route before release
A teaching aid: the three built-in examples contrast a vulnerable path-traversal route, a DOM XSS snippet and a hardened version
A draft 'why this is dangerous' note to attach to a code review

WHO IT'S FOR

Web developer: skims JavaScript or Node.js code for XSS and path traversal before shipping
Security beginner: learns from the vulnerable-versus-hardened examples
Bug-bounty hunter: picks the spots worth reading in a large bundle

START IN 5 MINUTES

# Open https://huggingface.co/spaces/face00/cybersecurity
# Paste code in the 'Paste Code / 50k-Line Bundle' tab, or drop a .js, .html, .ts, .php or .json file in 'Upload File'
# Press '⚡ Run 4-Step Security Audit'; findings appear on the right and pipeline diagnostics below
# Or click one of the three 'Quick Verification Scenarios' examples to try it at once

CAVEATS

Apache-2.0 for both the Space and the model (face00/qwen2.5-7b-security-cot, fine-tuned from Qwen2.5-Coder-7B-Instruct)
Runs on Hugging Face ZeroGPU — free, but queued and time-limited; each model call (one per slice) gets 35 s of GPU, and at most 4 slices are analysed per request
A new Space published 2026-09-13; findings are model output and can miss or invent issues, so verify before acting on them
The README is only the Space config; the only usage guidance is the app screen and app.py

RECEIPT

SIMILAR TOOLS

Up to five from SECURITY by ★ total: edited entries first, then repository cards; this entry is highlighted. Drawn from the same stored snapshot as the rankings — a comparison, not a recommendation. As of 09-16 21:00 UTC

NAME	★ TOTAL	▲ 7d	LICENSE	PLATFORM	LAST PUSH
open-code-reviewAI code review for developers	★ 28.6k	▲ +1,064	Apache-2.0permissive	windows · macos · linux · cli	2026-09-15
Qwen2.5 Program Slicing Security AuditorJavaScript security audit for web devsTHIS ENTRY	—	—	Licence unconfirmedunconfirmed	web	—
ente/enteCARD	★ 28.9k	▲ +13	AGPL-3.0copyleft	—	2026-09-13
deskflow/deskflowCARD	★ 28.8k	▲ +5	GPL-2.0copyleft	—	2026-09-11
laramies/theharvesterCARD	★ 17.4k	▲ +10	Licence unconfirmedunconfirmed	—	2026-09-10

SAME DAY